Crooks push Mac malware through fake OpenAI Codex ads

Hackers are employing fraudulent OpenAI Codex download pages to deceive Mac developers into executing malicious code disguised as installation commands. Cato Networks researchers discovered the scheme after noticing sponsored Google search results targeting individuals seeking to download Codex for macOS. The deceptive ads lead potential users to a well-crafted download page on Google Sites, complete with the familiar OpenAI branding.

However, no Codex is present; instead, the fraudulent site instructs Mac users to open Terminal, input a supplied command, and execute it. While presented as part of the installation process, the command surreptitiously initiates a multi-stage malware infection. This is a variation of the prevalent ClickFix technique, where attackers entice victims to execute harmful commands themselves rather than relying on a deceptive attachment or executable.

In this instance, the command begins with what appears to be a legitimate npm instruction for installing Codex. However, it is followed by code that decodes a Base64-encoded URL, retrieves an attacker-controlled shell script, and pipes it into zsh. This script downloads another stage, which contacts the attacker's server to confirm that someone has fallen for the ruse before downloading a Mach-O executable to "/tmp/helper."

It then clears macOS's security information, making the malware less likely to trigger warnings before it launches. Cato reported that the final binaries are universal Mach-O files, capable of running natively on both Intel-powered Macs and newer Apple Silicon machines.

The researchers identified significant similarities between this campaign and Atomic macOS Stealer, also known as AMOS, an infostealer previously distributed via fake software downloads and malicious advertising campaigns. While Cato has not officially labeled the malware as AMOS, numerous indicators suggest a strong connection, from the attack's staging to the construction of the final payload.

The criminals have also taken measures to prevent researchers from closely examining their creation. Although victims are initially directed to Google Sites, the malicious content is embedded within the page via an iframe, pulling data from attacker-controlled infrastructure based on factors such as the visitor's operating system and the path taken to reach the site.

This infrastructure adjusts the displayed content to appear harmless when the visitor is deemed unsuitable for the attackers' purposes.

Cato observed that the decoy site offered download buttons for both macOS and Linux, but only the Mac variant was found to deliver the malware chain. Codex is not the only AI coding assistant being targeted in this manner. Cato discovered a similar ClickFix page masquerading as Anthropic's Claude Code, sharing infrastructure with the Codex campaign.

Attackers don't need to exert much effort to find their targets, as developers searching for Codex inadvertently help them by pushing the fake download page above legitimate results in Google sponsored ads.